CVE-2024-1182

Published Jul 4, 2024

Last updated a month ago

CVSS high 7.0
Scada
OT

Overview

Description
Uncontrolled Search Path Element vulnerability in Mitsubishi Electric GENESIS64 versions 10.97.3 and prior, Mitsubishi Electric ICONICS Suite versions 10.97.3 and prior, Mitsubishi Electric Hyper Historian versions 10.97.3 and prior, Mitsubishi Electric MC Works64 all versions, Mitsubishi Electric GENESIS32 versions 9.7 and prior, Mitsubishi Electric Iconics Digital Solutions GENESIS64 versions 10.97.3 and prior, Mitsubishi Electric Iconics Digital Solutions ICONICS Suite versions 10.97.3 and prior, Mitsubishi Electric Iconics Digital Solutions Hyper Historian versions 10.97.3 and prior, and Mitsubishi Electric Iconics Digital Solutions GENESIS32 versions 9.7 and prior allows a local attacker to execute a malicious code by storing a specially crafted DLL in a specific folder when GENESIS64, ICONICS Suite, Hyper Historian, GENESIS32, and MC Works64 are installed with the Pager agent in the alarm multi-agent notification feature.
Source
Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp
NVD status
Deferred

Risk scores

CVSS 3.1

Type
Secondary
Base score
7
Impact score
5.9
Exploitability score
1
Vector string
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity
HIGH

Weaknesses

Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp
CWE-427

Social media

Hype score
Not currently trending

  1. به تازگی برای ICONICS Suite که یک نوع scada می باشد و در صنایع آب استفاده می شود ، آسیب پذیری با کد شناسایی (CVE-2024-1182) از نوع DLL hijacking و آسیب پذیری با کد شناسایی (CVE-2024-7587) از نوع DOS منتشر شده است. https://t.co/Poz3aKY03t https://t.co/Z1ejReTrF3

    @AmirHossein_sec

    15 Mar 2025

    27 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  2. به تازگی برای ICONICS Suite که یک نوع scadaمی باشدو درصنایع آب استفاده می شودآسیب پذیری با کد شناسایی (CVE-2024-1182)از نوع DLL hijacking و آسیب پذیری باکد شناسایی (CVE-2024-7587) از نوع DOS منتشر شده است. هکر ها بااستفاده ازاین دو آسیب پذیری می توانند کدهای مخرب را اجرا نمایند.

    @cybernetic_cy

    15 Mar 2025

    148 Impressions

    11 Retweets

    12 Likes

    1 Bookmark

    1 Reply

    0 Quotes

Related CVEs

  1. telnetd in GNU inetutils through 2.7 allows an out-of-bounds write in the LINEMODE SLC (Set Local Characters) suboption handler because add_slc does not check whether the buffer is full.•CVE-2026-32746
  2. A vulnerability in the Data Collection Agent (DCA) feature of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to gain DCA user privileges on an affected system. This vulnerability is due to the presence of a credential file for the DCA user on an affected system. An attacker could exploit this vulnerability by sending a crafted HTTP request and reading the file that contains the DCA password from that affected system. A successful exploit could allow the attacker to access another affected system and gain DCA user privileges. Note: Cisco Catalyst SD-WAN Manager releases 20.18 and later are not affected by this vulnerability.•CVE-2026-20128
  3. Cisco Catalyst SD-WAN Manager Exposure of Sensitive Information to an Unauthorized Actor Vulnerability•CVE-2026-20133
  4. A vulnerability in the API of Cisco Catalyst SD-WAN Manager could allow an authenticated, remote attacker to overwrite arbitrary files on the local file system. To exploit this vulnerability, the attacker must have valid read-only credentials with API access on the affected system. This vulnerability is due to improper file handling on the API interface of an affected system. An attacker could exploit this vulnerability by uploading a malicious file on the local file system. A successful exploit could allow the attacker to overwrite arbitrary files on the affected system and gain vmanage user privileges.•CVE-2026-20122
  5. All versions of InSAT MasterSCADA BUK-TS are susceptible to OS command injection through a field in its MMadmServ web interface. Malicious users that use the vulnerable endpoint are potentially able to cause remote code execution.•CVE-2026-22553

References

Sources include official advisories and independent security research.